This is a note to let you know that I've just added the patch titled
firewire: net: fix unexpected release of object for asynchronous request packet
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
firewire-net-fix-unexpected-release-of-object-for-asynchronous-request-packet.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f7dcc5e33c1e4b0d278a30f7d2f0c9a63d7b40ca Mon Sep 17 00:00:00 2001
From: Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
Date: Wed, 10 May 2023 10:35:33 +0900
Subject: firewire: net: fix unexpected release of object for asynchronous request packet
From: Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
commit f7dcc5e33c1e4b0d278a30f7d2f0c9a63d7b40ca upstream.
The lifetime of object for asynchronous request packet is now maintained
by reference counting, while current implementation of firewire-net
releases the passed object in the handler.
This commit fixes the bug.
Reported-by: Dan Carpenter <error27@xxxxxxxxx>
Link: https://lore.kernel.org/lkml/Y%2Fymx6WZIAlrtjLc@workstation/
Fixes: 13a55d6bb15f ("firewire: core: use kref structure to maintain lifetime of data for fw_request structure")
Link: https://lore.kernel.org/lkml/20230510031205.782032-1-o-takashi@xxxxxxxxxxxxx/
Signed-off-by: Takashi Sakamoto <o-takashi@xxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/firewire/net.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index af22be84034b..538bd677c254 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -706,21 +706,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
int rcode;
if (destination == IEEE1394_ALL_NODES) {
- kfree(r);
-
- return;
- }
-
- if (offset != dev->handler.offset)
+ // Although the response to the broadcast packet is not necessarily required, the
+ // fw_send_response() function should still be called to maintain the reference
+ // counting of the object. In the case, the call of function just releases the
+ // object as a result to decrease the reference counting.
+ rcode = RCODE_COMPLETE;
+ } else if (offset != dev->handler.offset) {
rcode = RCODE_ADDRESS_ERROR;
- else if (tcode != TCODE_WRITE_BLOCK_REQUEST)
+ } else if (tcode != TCODE_WRITE_BLOCK_REQUEST) {
rcode = RCODE_TYPE_ERROR;
- else if (fwnet_incoming_packet(dev, payload, length,
- source, generation, false) != 0) {
+ } else if (fwnet_incoming_packet(dev, payload, length,
+ source, generation, false) != 0) {
dev_err(&dev->netdev->dev, "incoming packet failure\n");
rcode = RCODE_CONFLICT_ERROR;
- } else
+ } else {
rcode = RCODE_COMPLETE;
+ }
fw_send_response(card, r, rcode);
}
--
2.40.1
Patches currently in stable-queue which might be from o-takashi@xxxxxxxxxxxxx are
queue-6.3/firewire-net-fix-unexpected-release-of-object-for-asynchronous-request-packet.patch
